PT-2007-4130 · Ksign · Ksign Ksignswat Activex Control

Kee Hong + 1 · Published 2007-05-22 · Updated 2017-07-29 · CVE-2007-2820

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KSign KSignSWAT ActiveX Control version 2.0.3.3

Description The issue is related to multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control. This can be exploited by remote attackers to execute arbitrary code via long arguments to certain functions, including (1) SWAT Init(), (2) SWAT InitEx(), (3) SWAT InitEx2(), (4) SWAT InitEx3(), and (5) SWAT Login().

Recommendations For version 2.0.3.3, as a temporary workaround, consider disabling the SWAT Init(), SWAT InitEx(), SWAT InitEx2(), SWAT InitEx3(), and SWAT Login() functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-2820

Affected Products

Ksign Ksignswat Activex Control

References · 8

• 🔥 https://exploit-db.com/exploits/3968 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2820 · Security Note
• http://secunia.com/advisories/25357 · Vendor Advisory
• http://marc.info/?l=full-disclosure&m=117981953312669&w=2 · Patch
• http://securityfocus.com/bid/24088 · Note
• http://vupen.com/english/advisories/2007/1901 · Note
• http://osvdb.org/36517 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34417 · Note